From bcdcd07947ee7272c446dd6871f96ebe173893d6 Mon Sep 17 00:00:00 2001 From: Ricardo Monla Date: Sat, 28 Feb 2026 17:39:45 -0300 Subject: [PATCH] [P2602][F1] SSH port 7022 verified on fenix+maurik, w-zombi payload ssh_port7022.ps1 --- adn/03_seguridad.md | 2 +- bitacoras/2026-02-28.md | 1 + tools/w-zombi/payloads/activo.ps1 | 46 ++++++++++++++----------- tools/w-zombi/payloads/ssh_port7022.ps1 | 46 +++++++++++++++++++++++++ 4 files changed, 74 insertions(+), 21 deletions(-) create mode 100644 tools/w-zombi/payloads/ssh_port7022.ps1 diff --git a/adn/03_seguridad.md b/adn/03_seguridad.md index f6be4adf..c75d4014 100644 --- a/adn/03_seguridad.md +++ b/adn/03_seguridad.md @@ -85,7 +85,7 @@ Las identidades permanecen activas mientras dure la sesión del agente SSH (sin | :--- | :--- | :--- | :--- | | **Hipervisores** (pmox1/2/3) | `root` | Llave RSA (passphrase `rsa`) | `ssh root@10.0.10.201` | | **VMs/CTs Linux** | `rmonla` | Llave RSA (desplegada) + sudo (`sudo`) | `ssh rmonla@10.0.10.4` | -| **VMs Windows** | `monlaricardo` | Password (`win_domain`) + OpenSSH | `ssh monlaricardo@10.0.10.200` | +| **VMs Windows** | `monlaricardo` | Password (`win_domain`) + OpenSSH **port 7022** | `ssh -p 7022 monlaricardo@10.0.10.200` | | **XenServer** (xen1) | `rmonla` | Password (`sudo`) | `ssh rmonla@10.0.10.23` | **Despliegue de llaves**: La llave pública de srv-ns8 (`~/.ssh/id_rsa.pub`) fue desplegada a todos los nodos Linux via `ssh-copy-id rmonla@` el 28/02/2026. diff --git a/bitacoras/2026-02-28.md b/bitacoras/2026-02-28.md index 27ee2dcb..7967f2a5 100644 --- a/bitacoras/2026-02-28.md +++ b/bitacoras/2026-02-28.md @@ -54,6 +54,7 @@ | ⏳ 10:52 | (IA) 🔧 Hostname VM 102 corregido: `srvv-SCERO` → `srvv-SITIO0`. | | ⏳ 11:00 | (IA) 📋 **XenServer agregado a P2602**: srv-xen1 + srvv-maurik + srvv-sysacadweb. Renombrado `srv-xen01` → `srv-xen1` en nodos/ontología. SSH `rmonla@` a srv-xen1 ✅ (password). Total: 15 guests a respaldar. | | ✅ 11:27 | (IA) 🧟 **OpenSSH en VMs Windows**: Instalado en srvv-fenix (`10.0.10.200`) y srvv-maurik (`10.0.10.10`) via w-zombi. SSH verificado con usuario `monlaricardo` (dominio). Credencial `win_domain` almacenada en bóveda. `[Físico: 0:21 hs]` | +| ✅ 17:38 | (IA) 🔒 **SSH Port Hardening**: Puerto cambiado de 22 → **7022** en srvv-fenix y srvv-maurik via payload w-zombi `ssh_port7022.ps1`. Verificado: port 7022 ✅, port 22 refused ✅. `[Remoto: 0:13 hs]` | ### Operaciones Centrales diff --git a/tools/w-zombi/payloads/activo.ps1 b/tools/w-zombi/payloads/activo.ps1 index dbb1bcd9..cf6162a8 100644 --- a/tools/w-zombi/payloads/activo.ps1 +++ b/tools/w-zombi/payloads/activo.ps1 @@ -7,34 +7,40 @@ function Log-Msg { } Log-Msg "==========================================================" -Log-Msg "INSTALANDO Y HABILITANDO OPENSSH SERVER NATIVO" +Log-Msg "CONFIGURANDO SSH EN PUERTO 7022" Log-Msg "==========================================================" + +$cfg = "C:\ProgramData\ssh\sshd_config" + try { - $sshCheck = Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH.Server*' - if ($sshCheck.State -ne 'Installed') { - Log-Msg "Instalando caracteristica OpenSSH.Server (esto puede tomar un minuto)..." - Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 | Out-Null - } else { - Log-Msg "OpenSSH.Server ya se encuentra instalado." - } + # Leer config, quitar cualquier linea Port anterior + $lines = Get-Content $cfg | Where-Object { $_ -notmatch '^\s*#?\s*Port\s+\d+' } + + # Agregar Port 7022 al inicio + $lines = @("Port 7022") + $lines + + # Escribir config limpia + $lines | Set-Content $cfg -Force + Log-Msg "sshd_config actualizado: Port 7022" - Log-Msg "Configurando servicio sshd en Inicio Automatico..." - Set-Service -Name sshd -StartupType 'Automatic' - Start-Service sshd -ErrorAction SilentlyContinue + # Firewall: agregar 7022, quitar 22 + New-NetFirewallRule -Name 'SSH-7022' -DisplayName 'SSH 7022' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 7022 -ErrorAction SilentlyContinue | Out-Null + Remove-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -ErrorAction SilentlyContinue + Log-Msg "Firewall actualizado: 7022 abierto, 22 cerrado" - if (!(Get-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -ErrorAction SilentlyContinue)) { - Log-Msg "Abriendo puerto TCP 22 en el Firewall local..." - New-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22 | Out-Null - } + # Reiniciar servicio + Stop-Service sshd -Force -ErrorAction SilentlyContinue + Start-Sleep -Seconds 2 + Start-Service sshd + Log-Msg "Servicio sshd reiniciado OK" - $ip = (Get-NetIPAddress -AddressFamily IPv4 | Where-Object InterfaceAlias -notmatch 'Loopback').IPAddress - Log-Msg "OpenSSH Server instalado y corriendo en el puerto 22." - Log-Msg "Conectar via: ssh Administrador@$($ip[0])" + $port = (Get-Content $cfg | Select-String "^Port").ToString().Trim() + Log-Msg "Verificacion: $port" } catch { - Log-Msg "Fallo al instalar SSH: $_" + Log-Msg "ERROR: $_" } Log-Msg "==========================================================" -Log-Msg "OPERACION COMPLETADA. Ahora SSH esta disponible." +Log-Msg "OPERACION COMPLETADA" Log-Msg "==========================================================" exit diff --git a/tools/w-zombi/payloads/ssh_port7022.ps1 b/tools/w-zombi/payloads/ssh_port7022.ps1 new file mode 100644 index 00000000..cf6162a8 --- /dev/null +++ b/tools/w-zombi/payloads/ssh_port7022.ps1 @@ -0,0 +1,46 @@ +function Log-Msg { + param([string]$Message) + Write-Host $Message -ForegroundColor Cyan + try { + Invoke-RestMethod -Uri "http://10.0.10.8:8000/log" -Method Post -Body @{msg=$Message} -UseBasicParsing -ErrorAction SilentlyContinue | Out-Null + } catch {} +} + +Log-Msg "==========================================================" +Log-Msg "CONFIGURANDO SSH EN PUERTO 7022" +Log-Msg "==========================================================" + +$cfg = "C:\ProgramData\ssh\sshd_config" + +try { + # Leer config, quitar cualquier linea Port anterior + $lines = Get-Content $cfg | Where-Object { $_ -notmatch '^\s*#?\s*Port\s+\d+' } + + # Agregar Port 7022 al inicio + $lines = @("Port 7022") + $lines + + # Escribir config limpia + $lines | Set-Content $cfg -Force + Log-Msg "sshd_config actualizado: Port 7022" + + # Firewall: agregar 7022, quitar 22 + New-NetFirewallRule -Name 'SSH-7022' -DisplayName 'SSH 7022' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 7022 -ErrorAction SilentlyContinue | Out-Null + Remove-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -ErrorAction SilentlyContinue + Log-Msg "Firewall actualizado: 7022 abierto, 22 cerrado" + + # Reiniciar servicio + Stop-Service sshd -Force -ErrorAction SilentlyContinue + Start-Sleep -Seconds 2 + Start-Service sshd + Log-Msg "Servicio sshd reiniciado OK" + + $port = (Get-Content $cfg | Select-String "^Port").ToString().Trim() + Log-Msg "Verificacion: $port" +} catch { + Log-Msg "ERROR: $_" +} + +Log-Msg "==========================================================" +Log-Msg "OPERACION COMPLETADA" +Log-Msg "==========================================================" +exit